(couchdb) branch docs-password-hashing created (now dda640e17)

[va...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

vatamane pushed a change to branch docs-password-hashing
in repository https://gitbox.apache.org/repos/asf/couchdb.git


      at dda640e17 Document upgrade_hash_on_auth

This branch includes the following new commits:

     new dda640e17 Document upgrade_hash_on_auth

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(couchdb) 01/01: Document upgrade_hash_on_auth

[va...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

vatamane pushed a commit to branch docs-password-hashing
in repository https://gitbox.apache.org/repos/asf/couchdb.git

commit dda640e17c2218101d8b534e7fa5da24c0588261
Author: Nick Vatamaniuc <va...@apache.org>
AuthorDate: Thu Sep 12 16:02:53 2024 -0400

    Document upgrade_hash_on_auth
---
 src/docs/src/config/auth.rst  | 12 +++++++++++-
 src/docs/src/whatsnew/3.4.rst |  5 +++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/docs/src/config/auth.rst b/src/docs/src/config/auth.rst
index 665a4fb74..306d9ecd5 100644
--- a/src/docs/src/config/auth.rst
+++ b/src/docs/src/config/auth.rst
@@ -387,6 +387,16 @@ Authentication Configuration
             [chttpd_auth]
             x_auth_username = X-Auth-CouchDB-UserName
 
+    .. config:option:: upgrade_hash_on_auth :: Auto-upgrade user auth docs on next auth call
+
+        .. versionadded:: 3.4
+
+        Upgrade user auth docs during the next successfull
+        authentication using the current password hashing settings. ::
+
+            [chttpd_auth]
+            upgrade_hash_on_auth = true
+
 .. config:section:: jwt_auth :: JWT Authentication
 
     .. config:option:: required_claims :: Mandatory claims in JWT tokens
@@ -396,7 +406,7 @@ Authentication Configuration
         is sent if any are missing. ::
 
             [jwt_auth]
-                required_claims = exp,iat
+            required_claims = exp,iat
 
     .. config:option:: roles_claim_name :: Optional CouchDB roles claim in JWT token \
         (deprecated)
diff --git a/src/docs/src/whatsnew/3.4.rst b/src/docs/src/whatsnew/3.4.rst
index 65e35d3c3..2a7ccb9f8 100644
--- a/src/docs/src/whatsnew/3.4.rst
+++ b/src/docs/src/whatsnew/3.4.rst
@@ -115,6 +115,11 @@ Highlights
   Entries in the password hash cache are time-limited, unused entries are
   automatically deleted, and there is a capacity bound.
 
+  Existing hashed user doc entries will be automatically upgrade and
+  re-hashed using the new password scheme during the next successful
+  authentication. To disable auto-upgrading set ``[chttpd_auth]
+  upgrade_hash_on_auth`` config setting to ``false``.
+
 * :ghissue:`4512`: Mango: add keys-only covering indexes. Improves query
   response times for certain queries up to 10x at p(95).